Modernise dep stack (tonic 0.14, prost 0.14, …) + encoding-size setter

[tobiemh]

What

Modernises the dep stack of the SurrealDB tikv-client fork to bring it in line with the rest of the SurrealDB workspace, and adds a Config::with_grpc_max_encoding_message_size setter so consumers can lift the 4 MB request-side cap.

Why

When SurrealDB's TiKV operational hardening PR went up against surrealdb/surrealdb-private#246, cargo deny flagged seven RUSTSEC advisories that all chained back to this crate's pinned deps:

• rustls-webpki 0.101.x (RUSTSEC-2026-0098, -0099, -0104) and rustls-pemfile (RUSTSEC-2025-0134) — pinned via tonic 0.10 → rustls 0.21.
• ansi_term (RUSTSEC-2021-0139) and atty (RUSTSEC-2024-0375) — transitive via the clap 2 dev-dep.
• instant (RUSTSEC-2024-0384) — transitive via serial_test 0.5 / parking_lot 0.11.

Bumping the runtime deps to current versions and dropping the live-cluster integration-test dev-dep block clears all seven. The SurrealDB workspace can then drop the corresponding deny.toml ignores once it points at `0.5.0`.

The encoding-side gRPC setter is the only API addition. SurrealDB already plumbs `SURREAL_TIKV_GRPC_MAX_ENCODING_MESSAGE_SIZE` end-to-end and reads it as a no-op pending this release.

Changes

Runtime deps:

Crate	Before	After	Note
`tonic`	0.10	0.14.5	`tls-native-roots`; clears 4× rustls* advisories
`prost`	0.12	0.14	Must match `tonic-prost 0.14`
`thiserror`	1	2
`async-recursion`	0.3	1.1
`derive-new`	0.5	0.7
`fail`	0.4	0.5
`prometheus`	0.13	0.14
`rand`	0.8	0.9	`thread_rng` → `rng`, `gen[_range]` → `random[_range]`
`lazy_static`	1	dropped	Two sites moved to `std::sync::LazyLock`
`serde_json` runtime	1	dropped	Only used by removed dev tests

Toolchain: `rust-toolchain.toml` bumped from `1.84.1` → `1.95.0` to satisfy the `edition2024` requirement introduced by `tonic 0.14` / `tokio 1.x`.

Proto regeneration (`proto-build/`):

• Switched from `tonic-build 0.10` to `tonic-prost-build 0.14`.
• Adjusted `compile_protos` call to the new `&[PathBuf]` include signature.
• Regenerated every `src/generated/*.rs` with the new codegen output (`tonic::codec::ProstCodec` → `tonic_prost::ProstCodec`).

New API:
```rust
let config = Config::default()
.with_grpc_max_decoding_message_size(64 * 1024 * 1024)
.with_grpc_max_encoding_message_size(64 * 1024 * 1024);
```
Threaded through `TikvConnect` and `PdRpcClient::connect`, applied via `.max_encoding_message_size(…)` on the `TikvClient` channel alongside the existing decoding limit.

Dev-deps + dead artefacts dropped:

• `[dev-dependencies]` trimmed to the minimum the live-cluster integration suite still needs (`env_logger`, `fail/failpoints`, `reqwest` with rustls, `serde_json`, `serial_test 3`, `tokio`); `clap 2`, `proptest`, `proptest-derive`, `rstest`, `tempfile` are gone.
• Deleted `examples/` and `src/proptests/` and the matching `[[example]]` entry. `tests/` is kept and gated on the existing `integration-tests` feature; it's the only entry point that exercises a real PD+TiKV cluster.
• Stripped the in-crate `#[cfg(test)]` modules that depended on the dropped dev-deps (proptest-derive markers on `Key`/`BoundRange`/`KvPair`; rstest cases in `src/raw/requests.rs`, `src/transaction/lock.rs`, `src/transaction/transaction.rs`; the tempfile-based test in `src/common/security.rs`).
• These upstream artefacts aren't run from any SurrealDB workflow and are recoverable from `tikv/client-rust` history if needed.

Crate metadata: version `0.3.0-surreal.4` → `0.5.0`. Repository URL and description updated to mark this as the SurrealDB fork.

Note on the version choice: this is the first release from the SurrealDB-owned fork (default branch moved to `main`; we no longer track upstream `tikv/client-rust` versions). The crate is published as `surrealdb-tikv-client`, which already disambiguates from upstream's `tikv-client`, so the `-surreal.N` suffix is dropped in favour of plain semver. `0.5.0` also sorts unambiguously above upstream's `0.4.0` publish (2026-02-07), which kept the same vulnerable dep stack as 0.3.0.

Verification

• `cargo run -p tikv-client-proto-build` regenerates `src/generated/*.rs` cleanly.
• `cargo check` succeeds with 24 inherited upstream warnings, zero errors.

Follow-up for consumers

Once this is released:

1. Bump the workspace dep in `surrealdb/surrealdb-private` to `surrealdb-tikv-client 0.5.0`.
2. Drop the seven now-unused `RUSTSEC-*` ignores from `deny.toml`.
3. Wire the `with_grpc_max_encoding_message_size` setter in the TiKV `Datastore::new` path so the `SURREAL_TIKV_GRPC_MAX_ENCODING_MESSAGE_SIZE` env var stops being a no-op.